Rationale

With the introduction of private projects and distributions, owner need a way give share to hundreds of private project artefacts.

Stakeholders need to know who they are sharing with, and in a single action, share more or unshare. This is valuable to public project with default private bug and branches--once restricted data is shared with a company team, all employees have access to company information.

e.g. Steve Magoun from OEM would like to be able to see exactly who has access to every component in his project.

Stakeholders

User stories

Commercial stories

As a commercial project ownerI want to mark some data as proprietary that should not be shared with other projectsso that information provided in confidence is not disclosed

As a commercial project ownerI want share proprietary information with users and teamsso that my organisation and contractors can collaborate<<BR>

Canonical stories

As a member of ~canonicalI want to share everything proprietary data in my project with ~canonicalso that that members of my organisation are not blocked from collaborating<<BR>

As a member of ISI want to add a new employee to the ~canonical teamso that that he has access to all information shared with ~canonical<<BR>

As a member of ISI want to run remove all things shared with a former Canonical member in Canonical projectsso that that confidential data is not disclosed<<BR>

OEM stories

As a maintainer of OEM projects (~pmteam)I want to share everything with ~oem-dev (the driver)so that they I can delegate all development to them

As a driver OEM projects (~pmteam)I want to share some bugs and branches with a contractorso that he can fix the issues for us

As a maintainer of OEM projects (~pmteam)I want to see all users who have some things shared with themso that I can share nothing with them if they are not under contract

Ubuntu stories

As a the maintainer of Ubuntu<BR>> I want to unshare user-data with maintainer and share user-data with the apport botso that no human has access to personal user-data<<BR>

As a the maintainer of Ubuntu<BR>> I want to unshare security with maintainer and share user-data ~ubuntu-securityso that only trusted experts see security issues

Constraints and Requirements

Must

A lists of all the users with all or some things shared. The view must also show exactly how the user has access, for example: directly or via a team; as a (core?) contributor or as a user; by subscribing to some artefacts or through access to the whole project.

A summary everything an user may know about the project.The view must also show how the user was shared: direct or via a team.

A way to share everything with a user or team.When a owner shares with a team, the view must show who who is being shared with and how many members (person-picker).

A way to unshare everything with a user or team. Revocation removed all subscriptions to individual artefacts be default. The owner many choose to keep some subscription so that partial access is allowed. If the user has access via a team, the view must explain how to remove either the user or the team to unshare.

Nice to have

List the users who everything is shared via the owner or driver team. The owner may need to know about contributors as well as users. If the owner can unshare with an owner/driver, then the user must be removed from the team and assignments and subscriptions are removed too.

Must not

Unsharing with a user or team must not allow the user to have some things shared.Revoking access to a user must remove the individual subscriptions that provide partial access.

Sharing must not cede control of what is shared.Inclusive teams (open and delegated) may not be shared with. Inclusive teams allow anyone to choose to become a member, which undermines the owner's power to manage the information disclosure.

Subfeatures

Replace bug and branch privacy mechanism with a common way classify the data

private and security/branch visibility do not interact with each other or meet the needs of sharing all of a kind of restricted data.